hashpackfirmware[.]app[.]apexfix[.]xyz

Analysis of the domain hashpackfirmware.app.apexfix.xyz indicates it was actively used in a phishing campaign targeting users of the HashPack cryptocurrency wallet. The domain, registered on April 23, 2025, through NiceNIC International Group Co., Limited, resolved to the IP address 198.251.89.220, hosted by FranTech Solutions (AS53667) in the United States. Nameservers for the domain were ns27.asurahosting.com and ns28.asurahosting.com, suggesting the use of Asura Hosting for DNS management. At the time of assessment, the domain was offline, though it had previously displayed a page titled 'Hashpack,' directly referencing the legitimate HashPack wallet service.

Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, with PhishDestroy listing it on its blocklist. The absence of an SSL certificate further reduces its legitimacy, as modern phishing domains typically employ HTTPS to appear credible. The domain appeared on only one security blocklist, which may indicate either a recent takedown or limited detection coverage at the time of analysis. No additional details about the phishing kit, payload delivery mechanism, or specific user interactions were available in the provided intelligence.

Defenders should treat this domain as part of a broader campaign targeting cryptocurrency users, particularly those familiar with HashPack. The use of a subdomain (apexfix.xyz) combined with a deceptive subdirectory (hashpackfirmware.app) follows a common tactic to evade casual scrutiny. Given the domain's current offline status, monitoring for re-registration or similar patterns under alternative TLDs or registrars is recommended. Organizations should update web filtering rules to block the domain and its associated IP, while cryptocurrency service providers may consider issuing warnings to users about this specific threat vector.